Their security was bad, no doubt. I don't see how that justifies deleting their data, though.

Like handling nuclear material, if a company is going to collect intelligence on consumers, they have a social obligation to secure that intelligence. Encrypt it, tokenize/anonymize it, or delete it after use. Anything less and you're simply positioning yourself as a facilitator of doxxing or stalking when data leakage or exfiltration inevitably happens.

If it was this easy to break in and access the data, the hacker did consumers a kind mercy by deleting it before someone else got in and did something more nefarious.

??!? Their 'data' includes all the photos YOUR KIDS take on their phones. Do you not realize how much absolutely idiotic shit kids do with their smartphones these days? Which they store in an an obviously unsafe way, as evidenced by the fact that they've been hacked via a super-super-super obvious software flaw... twice (that was widely reported on, most likely many more times). They deserve, and they should get, no sympathy. They sure as shit don't deserve to make any money off of it.

You know what other services have data that contains photos of your "YOUR KIDS"? Google, Facebook, Amazon, Apple, Microsoft, Sony, Photobucket, and pretty much every other tech company with hosting services. If these companies get hacked, do they deserve to have their data deleted? The answer is no.

No, they would deserve a hefty, HEFTY fine and regulation barring them from providing services to anyone under 18 years of age, and then they deserve to delete all the relevant data themselves (with oversight). However Google, Facebook, Amazon, Apple, Microsoft, Sony, Photobucket are not in the business of selling shady ass spyware whose sole reason for existing is for stalkers, creeps, jealous ex-lovers and helicopter parents to invade people's privacy and personal security, so they have at least a little bit going for them over this sleazeball company. _Very_ little, but a little still.

As TFA describes it, the first deletion last year by the heroic hacker actually interrupted another hacker's access to the data. Why hadn't that other hacker deleted it? Maybe he enjoyed having access to private pictures and communications of children, teens, and adults... Does that sound like a good situation?

No, that doesn't sound like a good situation. You want to know some other big companies that have been hacked? - LinkedIn, MySpace, Adobe, Dropbox, DailyMotion, Sony, Kickstarter, Equifax... ad infinitum. Do these companies also deserve to have their data deleted?

None of those firms collected private pictures without consent. All of them actually made some attempt to fix their vulnerabilities when notified. Any one of them that allowed random strangers to delete their data "deserved" to have that done. No firm has a right to success in business.

So that actual bad guys don't get it and use it for what could be incredibly sophisticated and damaging things.

Ok. Then what does that justify in your mind?

Companies that practice bad security and potentially expose sensitive data to bad actors should be fined or shutdown via the proper legal channels. In the more extreme cases, I think short jail terms should be considered for those responsible depending on the extent of the damage caused.